The risk & compliance think tank — Identifying the next emerging risk

September 22, 2009 — sohandhande

There is now a broad consensus that the credit crisis was sparked by a lack of appreciation of the risks being taken within the financial sector — and the wide-ranging impact they could have. Scarred by this experience, many businesses are upping their game in all aspects of risk management.

One question which continues to vex them however is how to spot the next big emerging risk; the risk which could do for one sector what sub-prime did for the banks. The answer to that question is out there — but does not come in one neatly packaged solution as John Farrell of KPMG’s Advisory practice explains.

After the traumatic events of recent months, it should be no surprise that a lot of time and effort is being expended on ensuring that we avoid a repeat of the sub-prime crisis.

Many businesses around the world are currently considering how they can improve their capabilities for identifying that next big emerging risk — long before it has time to manifest itself into something truly damaging and destructive.

However, I believe that much of the thinking in this area may be misdirected. Too many organizations are looking for that magic solution; the silver bullet which will home in on the gravest danger and eliminate it with a minimum of fuss.

They are wasting their time. There is no switch which can be flicked, no toolkit which can be installed, no crystal ball which can be relied upon. Rather, companies should seek to better understand their own risk capabilities as the answer lies within their existing risk management frameworks and risk culture. These should be redirected and refocused — as many businesses appear to be currently looking in the wrong places.

Emerging risks do not appear as a dust cloud on the horizon; something which the most eagle-eyed observer with the best telescope might hope to spot. Instead, these risks frequently emerge from within — as a direct consequence of management actions. The trick therefore is having the thinking and techniques in place to consider all the possible risk ramifications which can arise from key business decisions.

The genesis of a new emerging risk is not something nebulous or shrouded in mystery. They are created out of change. Business models change, technologies change, unemployment rises and falls, industries become fashionable while others are rendered obsolete. That change can be calm and slow or rapid and volatile. What matters is the ripple effect as dozens of variables then change throughout a business. Unless risk management capabilities can keep pace, then a new emerging risk is created, right under their noses.

The sub-prime crisis is a perfect example of this. It was years ago that banks first started lowering their lending parameters to include more potential borrowers. Very few people batted an eyelid at this shift in lending strategy or appreciated the damage that such a policy could cause if it went wrong. The risk sentry remained on the wall, his eye glued to the horizon but he was wasting his time. The enemy was already within the walls.

Looking to the future, the ability to spot how change has created a new risk should be the responsibility of all employees, not a select few in a risk function. Every employee must be able to articulate what they see as a growing risk issue, confident that their assessment of pending danger is being fed into a process which monitors such concerns.

Businesses should be asking whether they could do more in terms of training and awareness to improve their ability to spot new risks. Any who believe that they can simply install a new product or solution and thus circumvent all this are deluding themselves. The answer lies within a more self-aware risk culture with better trained employees able to get the right info to the right people in timely fashion. It also requires management to be far more aware of the chain of events which every single management decision can initiate.

They should also keep a much closer eye on the impact of events outside of their control. Increasingly, I am seeing a greater focus on systemic risk; the risks posed to businesses by things like economic meltdown, spiraling unemployment, rapid inflation or deflation — perhaps even the effect of a global pandemic. Scenario analysis will be a key tool in preparing for the fall-out of such risks, asking countless ‘what if’ questions and implementing contingency plans for the day that hypothesizing and speculating becomes reality.

This is the reality of spotting the ‘next big thing’ in the risk world. Anyone who comes to me asking for a simple, boxed-up solution to this problem will be disappointed. Businesses should develop a broader risk awareness — of systemic risk, of potential new sources of risk and of the impact of change within their business.

One of the best ways to deal with this is in enhancing and refocusing existing capabilities within an organization; it is nothing new. Perhaps the biggest risk we actually face is that too many businesses might not realize this.